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2018 HAVA Grant Funds Program Narrative 


The Consolidated Appropriations Act of 2018 provided $380,000,000 in Help America Vote Act 
(HAVA) money to improve the administration of U.S. elections. Colorado’s share of this 
appropriation, funded through the Election Assistance Commission (EAC) is $6,342,979. This 
narrative lays out how Colorado will use these funds to “improve the administration of a federal 
election” through enhanced technology and security improvements in Colorado’s election 
process under Section 101 of HAVA (P.L. 107-252) the Help America Vote Act of 2002. 

The Colorado Secretary of State serves as Colorado’s Chief Election Official. The Department of 
State’s (Department) mission is to ensure that every eligible Coloradan can register to vote with 
ease and cast their vote with the confidence that their choices are accurately tallied and that those 
voting in the election are legally eligible to do so. These past several years, the Department has 
expended extraordinary time and resources to protect the Colorado voter registration database 
(SCORE) and all other physical and technical election systems and processes. The Secretary of 
State’s office will use the newly appropriated HAVA funds to further harden its systems and 
improve the state’s security posture through various additional methods described below. In 
addition, the Department has received interim spending authority from the Joint Budget 
Committee of the Colorado General Assembly to provide the required state match of $317,149. 

The funds were appropriated for use upon signature by President Donald Trump on March 22, 
2018. Thus, the Department commits to fully utilize the additional HAVA funds by March 22, 
2023. 


Project Overview 

The Colorado Department of State followed a multi-pronged approach to determine how the 
HAVA funds should be utilized. First, election and information technology personnel from the 
office solicited experts in the field for their recommendations. Second, internal meetings were 
held to determine prioritization. When that list was completed, a public meeting of the Bipartisan 
Election Advisory Committee was held with county clerks and community representatives to 
advise them on the Department’s preliminary ideas and solicit their input. Citizens and election 
officials provided feedback, including recommendations for changes and additions. Those were 
incorporated into the final document and budget. 

The Colorado Department of State plans to use the 2018 HAVA appropriation in various ways to 
further harden its systems and improve the state’s security posture. These include three general 
categories: 1) Improved Technology and Software for Both State and County Election Officials, 
2) Improved Risk-Limiting Audits and Audits of Elections-Related Systems, and 3) Improved 
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Incident Preparedness Exercises and Training, Along With Certification Program Integration. 
The following section details some of the ways in which Colorado currently plans to use the 
awarded funds: 


Improved Technology and Software for Both State and County Election Officials 

• Expansion of secure portal for sensitive information exchange 

o Currently use a commercial product for secure return of ballots from UOCA VA voters. 
The Department is exploring the possibility of leveraging the same platform for sensitive 
information and data exchanges between counties and between counties and the state, to 
improve the security of that information sharing. 

■ Implementation Timeline: 2018-2019 

• Smart, secure removable media for elections data exchanges 

o Sophisticated USB devices for transmitting information in a secure manner from system 
to system. 

■ Implementation Timeline: 2018-2019 

• Dev team for modernization of core SCORE application 

o Legislative changes to SCORE and WebSCORE continue to affect the ability to carry 
through on efforts to modernize legacy SCORE functionality. The Department will add a 
new development team for an 18-24 month period to increase our capacity and deliver 
needed functionality, along with upgraded security. 

■ Implementation Timeline: 2018-2019 

• Software/Service for tracking social media and dark web for threats and indicators of compromise 

o Situationed awareness of actual threats, claimed threats, and sensitive elections data may 
provide an early warning system to assist in preparation for elections. The Department is 
exploring the potential of adding social media and dark web intelligence gathering as part 
of our defenses. 

■ Implementation Timeline: 2018-2020 

• Security automation and orchestration platform 

o Cybersecurity solutions today are incorporating more automated analysis and correlation 
capabilities and are allowing near-real-time defensive countermeasures to threats. 
Orchestration describes the practice of tying disparate tools eind people together for 
focused, effective action as threats and incidents occur. 

■ Implementation Timeline: 2019-2020 

• Emergency/Critical communications capability 

o Exploring adding rapid response communications capability to reach not only to HQ- 
based elections staff but also to the critical individuals leading teams at every Voter 
Service and Polling Center (VSPC) 

■ Implementation Timeline: 2018-2019 
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• New Voting System Implementation Assistance 

o A handful of Colorado counties have not yet purchased and deployed new voting systems 
within the past five years that provide better support for post-election risk-limiting audits. 
The department will offer grants to counties to offset half the cost of implementation 
services and training for these few counties. 

■ Implementation Timeline: 2019-2020 


Improved Risk Limiting Audits and Audits of Elections-Related Systems 

• Improvements to risk-limiting audits (RLA) systems 

o The Department is currently working to improve the existing RLA system for the 2018 
General Election. This work will continue beyond this year to extend the RLA system for 
use in primary elections. 

■ Implementation Timeline: 2018-2019 

• Security audits of all elections-related systems 

o Risk-limiting audits of ballots post-election are crucial to provide confidence in correct 
outcomes. The Department also plans to add audits of other elections-related systems. 

■ Implementation Timeline: 2019-2021 

Improved Incident Preparedness Exercises and Certification Program Integration 

• Table Top Exercises on incident response and preparedness 

o The department is already planning for a first statewide table top exercise (TTX) to 
bolster awareness and test incident response plans of county and state stakeholders. TTX 
and mock election exercises serve to train individuals in stressful situations to better 
prepare and anticipate real world situations. 

■ Implementation Timeline: 2018 (and continuing in the future) 

• Vulnerability/Penetration tests of elections-related systems 

o Work to establish vulnerability and penetration tests of elections-related systems. 

■ Implementation Timeline: 2019-2021 

• Attacker/Defender exercises 

o These simulations involve one team acting as an attacker with another team defending 
against those attacks. These types of exercises not only help reveal weaknesses in cyber 
security defenses, they also provide valuable training and experience in a simulated 
environment. 

■ Implementation Timeline: 2019-2020 

• Integration of white hat hacking into SDLC (software development life cycle) 

o Vulnerability scanning and code reviews form a valuable part of our software 
development process. Incorporating penetration tests into the process earlier than is 
currently done today will improve the security and resilience of the software created and 
supported in the office. 

■ Implementation Timeline: 2019 
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2018 HAVA ELECTION SECURITY GRANT 

Budget Information 

CFDA # 90.404 Non-Construction Program 

Name of Organization: 

Budget Period Start: 

Budget Period End: 

Colorado Secretary c 

3/23/2018 

3/23/2023 

f State's Office 

SECTION A- BUDGETSUMN 

FEDERAL &NON-I 

(Consolidated Budget for total project term- 
FEDERAL FUNDS (Match) up to 5 years as defined by grantee) 

PROGRAM CATEGORIES 

BUDGET CATEGORIES 

(a) Voting 
Equipment 

(b) Election 
Auditing 

(c) Voter 
Registration 
Systems 

(d) Cyber Security 

(e) Communications 

(f) Other 

Training Programs 

(g) Other 

TOTALS 

% Fed Total 

1. PERSONNEL (including fringe) 








$ 

0% 

2. EQUIPMENT 


$ 47,619.05 

$ 428,571.43 

$ 1,518,095.22 

$ 128,571.43 



$ 2,122,857.13 

33% 

3. SUBGRANTS- to local voting jurisdictions 

$ 47,474.29 







$ 47,474.29 

1% 

4. TRAINING 




$ 47,619.05 


$ 428,571.43 


$ 476,190.48 

8% 

5. All OTHER COSTS 


$ 476,190.47 

$ 1,238,095.22 

$ 1,144,076.18 

$ 838,095.23 



$ 3,696,457.10 

58% 

6. TOTAL DIRECT COSTS (1-6) 

$ 47,474.29 

$ 523,809.52 

$ 1,666,666.65 

$ 2,709,790.45 

$ 966,666.66 

$ 428,571.43 

$ 

$ 6,342,979.00 


7. INDIRECT COSTS (if applied) 








$ 

0% 

8. Total Federal Budget 

$ 47,474.29 

$ 523,809.52 

$ 1,666,666.65 

$ 2,709,790.45 

$ 966,666.66 

$ 428,571.43 

$ 

$ 6,342,979.00 


11. Non-Federal Match 

$ 2,373.71 

$ 26,190.48 

$ 83,333.35 

$ 135,489.55 

$ 48,333.34 

$ 21,428.57 


$ 317,149.00 


12. Total Program Budget 

$ 49,848.00 

$ 550,000.00 

$ 1,750,000.00 

$ 2,845,280.00 

$ 1,015,000.00 

$ 450,000.00 

$ 

$ 6,660,128.00 


13. Percentage By Category 

1% 

8% 

26% 

43% 

15% 

7% 

0% 






Proposed State Match 

5.0% 




A. Do you have an Indirect Cost Rate Agreement approved by the Federal government or 
some other non-federal entity? 

If yes, please provide the following information: 

B. Period Covered by the Indirect Cost Rate Agreement (mm/dd/yyyy-mm/dd/yyy): 

No 



C. Approving Federal agency: 

D. If other than Federal agency, please specify: 

E. The Indirect Cost Rate is: 





























































